fix security leak for bug 941260 CWE-601
added tests for coverage